pfSense

<?php

/*

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 * All rights reserved.

 *

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

$blockaliasname = 'EasyRuleBlockHosts';

require_once("functions.inc");

require_once("util.inc");

	global $config;

	/* Borrowed from firewall_rules.php */

		$iflist['l2tp'] = "L2TP VPN";

	}

	foreach ($iflist as $if => $ifd) {

		return "ipsec";

	}

		return "wireguard";

	}

}

	/* No rules, we we know it doesn't exist */

	if (!is_array($config['filter']['rule'])) {

		return false;

	}

	/* Search through the rules for one referencing our alias */

}

	/* If the alias doesn't exist, exit.

	 * Can't create an empty alias, and we don't know a host */

	/* If the rule already exists, no need to do it again */

	/* Make up a new rule */

	$filterent = array();

	$filterent['type'] = 'block';

	$filterent['destination']['any'] = '';

	// Using same code, variables, and techniques here.

	$after = -1;	// Place rule at top and move all separators.

	array_splice($a_filter, $after+1, 0, array($filterent));

	$tmpif = $int;

	// Update the separators

	$ridx = ifridx($tmpif, $after);	// get rule index within interface

	$mvnrows = +1;

	move_separators($a_separators, $ridx, $mvnrows);

	return true;

}

function easyrule_block_alias_getid($int = 'wan') {

	global $blockaliasname, $config;

	/* Hunt down an alias with the name we want, return its id */

		if ($alias['name'] == $blockaliasname . strtoupper($int)) {

	}

	return false;

}

function easyrule_block_alias_add($host, $int = 'wan') {

	global $blockaliasname, $config;

	/* If the host isn't a valid IP address, bail */

	/* Try to get the ID if the alias already exists */

	$id = easyrule_block_alias_getid($int);

	$alias = array();

		list($host, $mask) = explode("/", $host);

	} elseif (is_specialnet($host)) {

		$mask = 0;

		$mask = 128;

		$mask = 32;

	}

		// Catch case when the list is empty

		if (empty($a_aliases[$id]['address'])) {

			$a_address = array();

			$a_detail = array();

		} else {

			$a_address = explode(" ", $a_aliases[$id]['address']);

			/* Make sure this IP isn't already in the list. */

			if (in_array($host.'/'.$mask, $a_address)) {

				return true;

			}

			$a_detail = explode("||", $a_aliases[$id]['detail']);

		}

		$alias['name']    = $a_aliases[$id]['name'];

		$alias['type']    = $a_aliases[$id]['type'];

		$alias['descr']   = $a_aliases[$id]['descr'];

		$a_detail[] = gettext('Entry added') . ' ' . date('r');

		$alias['address'] = join(" ", $a_address);

		$alias['detail']  = join("||", $a_detail);

		/* Create a new alias with all the proper information */

		$alias['type']    = 'network';

	/* Replace the old alias if needed, otherwise tack it on the end */

	// Sort list

	$a_aliases = msort($a_aliases, "name");

	return true;

}

	/* Bail if the supplied host is not a valid IP address */

	/* Flag whether or not we need to reload the filter */

	$dirty = false;

	/* Attempt to add this host to the alias */

	if (easyrule_block_alias_add($host, $int)) {

		$dirty = true;

	} else {

		/* Couldn't add the alias, or adding the host failed. */

		return false;

	}

	/* Attempt to add the firewall rule if it doesn't exist.

	 * Failing to add the rule isn't necessarily an error, it may

	 * have been modified by the user in some way. Adding to the

	 * Alias is what's important.

	 */

		if (easyrule_block_rule_create($int, $ipproto)) {

		} else {

			return false;

		}

	}

	/* If needed, write the config and reload the filter */

	if ($dirty) {

			header("Location: firewall_aliases.php");

			exit;

		} else {

			return true;

		}

		return false;

	}

}

	/* Make up a new rule */

	$filterent = array();

	$filterent['type'] = 'pass';

	$filterent['interface'] = $int;

	/* Default to only allow echo requests, since that's what most people want and

	 *  it should be a safe choice. */

		list($srchost, $srcmask) = explode("/", $srchost);

	} elseif (is_specialnet($srchost)) {

		$srcmask = 0;

		$srcmask = 128;

		$srcmask = 32;

	}

	if (is_subnet($dsthost)) {

		list($dsthost, $dstmask) = explode("/", $dsthost);

	} elseif (is_specialnet($dsthost)) {

		$dstmask = 0;

		$dstmask = 128;

		$dstmask = 32;

	}

	pconfig_to_address($filterent['source'], $srchost, $srcmask);

	pconfig_to_address($filterent['destination'], $dsthost, $dstmask, '', $dstport, $dstport);

		header("Location: firewall_rules.php?if={$int}");

		exit;

	} else {

		return true;

	}

}

		$int = easyrule_find_rule_interface($int);

		if ($int === false) {

	} else {

function easyrule_parse_unblock($int, $host, $ipproto = "inet") {

	global $blockaliasname, $config;

	if (!empty($host) && !empty($int)) {

		$host = trim($host, "[]");

		if (!is_ipaddr($host) && !is_subnet($host)) {

			return gettext("Tried to unblock invalid IP:") . ' ' . htmlspecialchars($host);

		}

		$real_int = easyrule_find_rule_interface($int);

		if ($real_int === false) {

			return gettext("Invalid interface for block rule:") . ' ' . htmlspecialchars($int);

		}

		/* Try to get the ID - will fail if there are no rules/alias on this interface */

		$id = easyrule_block_alias_getid($real_int);

		if ($id === false || !$config['aliases']['alias'][$id]) {

			return gettext("No block rules set on interface:") . ' ' . htmlspecialchars($int);

		}

		if (is_subnet($host)) {

			list($host, $mask) = explode("/", $host);

		} elseif (is_specialnet($host)) {

			$mask = 0;

		} elseif (is_ipaddrv6($host)) {

			$mask = 128;

		} else {

			$mask = 32;

		}

		// Create the expected string representation

		$unblock = $host.'/'.$mask;

		$a_address = explode(" ", $config['aliases']['alias'][$id]['address']);

		$a_detail = explode("||", $config['aliases']['alias'][$id]['detail']);

			unset($a_detail[$key]);

			// Write back the result to the config array

			$config['aliases']['alias'][$id]['address'] = join(" ", $a_address);

			$config['aliases']['alias'][$id]['detail'] = join("||", $a_detail);

			// Update config

			if (!empty($_SERVER['DOCUMENT_ROOT'])) {

				header("Location: firewall_aliases.php");

				exit;

			} else {

				return gettext("Host unblocked successfully");

			}

		} else {

	}

	return gettext("Tried to unblock but had no host IP or interface");

}

function easyrule_parse_getblock($int = 'wan', $sep = "\n") {

	global $blockaliasname, $config;

	$real_int = easyrule_find_rule_interface($int);

	if ($real_int === false) {

		return gettext("Invalid interface for block rule:") . ' ' . htmlspecialchars($int);

	}

	/* Try to get the ID - will fail if there are no rules/alias on this interface */

	$id = easyrule_block_alias_getid($real_int);

	if ($id === false || !$config['aliases']['alias'][$id] || empty($config['aliases']['alias'][$id]['address'])) {

		return gettext("No block rules set on interface:") . ' ' . htmlspecialchars($int);

	}

	return join($sep, explode(" ", $config['aliases']['alias'][$id]['address']));

}

	global $protocols_with_ports;

	$dst = trim($dst, "[]");

	if (!empty($int) && !empty($proto) && !empty($src) && !empty($dst)) {

		$int = easyrule_find_rule_interface($int);

		if ($int === false) {

		if (getprotobyname($proto) == -1) {

		if (in_array($proto, $protocols_with_ports)) {

			if (empty($dstport)) {

		} else {

			$dstport = 0;

		}

		/* Should have valid input... */

	} else {